ci: adopt resolved ksail fixes (lift 7.65.0 determinism pin) - #2265
Merged
Conversation
The ksail issues this repo's CI worked around are now resolved upstream: - #5371 (non-deterministic in-process Helm render) closed COMPLETED, so the validate/scan job no longer needs the 7.65.0 freeze — lift it back onto the Renovate-managed latest (7.77.0), grouped with the deploy pins, with a tripwire to re-pin if validate/scan flake run-to-run again. - #5369 (native Kubescape scan exceptions) shipped — refresh the scan comment; wiring the platform's ClusterSecurityException CRs in to ratchet the threshold toward 100 is tracked in #2264. Also reconcile the AGENTS.md Validation bullets, which cited the closed issues as open blockers and contradicted themselves on the threshold (85 vs 94; CI uses 85). The pin lift can only be proven by CI (the scan score is environment-dependent and not reproducible offline), so this is a draft pending green, deterministic CI runs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
|
🎉 This PR is included in version 1.79.5 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The ksail limitations this repo's CI was working around are now resolved upstream. This adopts the fixes and refreshes the now-stale references.
validate/scandeterminism pin. The non-deterministic in-process Helm render (ksail#5371) is closed COMPLETED, so the Setup-KSail step rejoins Renovate management (groupedksailwith the deploy-prod / dr-rebuild pins) at the latest release (7.77.0). A tripwire comment says to re-pin + reopen #5371 ifvalidate/scanever swing run-to-run again.ClusterSecurityExceptionCRs in to ratchet--compliance-thresholdtoward 100 is tracked in ci: ratchet the Kubescape scan threshold toward 100 via ksail workload scan --exceptions (#5369 shipped) #2264. The threshold stays 85 here.AGENTS.mdValidation bullets, which cited the now-closed issues as open blockers and contradicted themselves on the threshold (one bullet said85, another said94; CI uses85). Now two consistent bullets matching the## Two non-obvious limitsintro.Why this is a draft — promotion gate
The pin lift can only be proven by CI: the platform documents that the Kubescape compliance score is environment-dependent and not reproducible offline, and determinism is a run-to-run property. Promote once CI is green and
validate/scanis confirmed deterministic across a few runs — and the scan score on7.77.0clears the 85 floor (a ksail bump can shift the score; the comment now flags re-baselining). If it flakes or drops below 85, re-pin per the tripwire instead of promoting.Out of scope (deliberately)
ksail.prod.yamlis a protected file, so its inline comments that still reference resolved items (#5015 user_data limit, #5017→#5021maxNodesTotal, #5277capacityBuffers, the expander-list note — all merged/shipped) are left untouched. Flagging here so a maintainer can refresh them directly if wanted.--exceptionswiring + threshold ratchet → tracked in ci: ratchet the Kubescape scan threshold toward 100 via ksail workload scan --exceptions (#5369 shipped) #2264 (needs the released flag's input format + CI to establish the new stable floor).Validation
actionlint .github/workflows/ci.yamlpasses. No manifest changes (k8s/**untouched), so noksail workload validateis required — this is CI config + docs only.Filed from a holistic platform↔ksail review (the same review that fed ksail#5441 / #5442 / #5443 and evidence onto the open epic ksail#5344 upstream).